Skills website-to-video

📦

website-to-video

Name: website-to-video
Author: heygen-com

Content revision r2 High Risk 📁 Filesystem access⚡ Contains scripts🔑 Env variables⚙️ External commands🌐 Network access

Create a Branded Video From Any Website

Turning a website into a coherent video requires capture, creative planning, narration, animation, and review. This skill guides the complete HyperFrames workflow using the site's own brand assets.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "website-to-video" from https://skillstore.io/skills/heygen-com-website-to-video.md and its manifest at https://skillstore.io/api/skills/heygen-com-website-to-video/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/heygen-com-website-to-video.md Signed manifest GET /api/skills/heygen-com-website-to-video/manifest Signed lockfile GET /api/skills/heygen-com-website-to-video/lockfile

Test it

Using "website-to-video". Create a 15-second portrait clip from a design studio homepage.

Expected outcome:

A concise brand summary covering audience, visual voice, colors, typography, and signature assets.
An approved beat plan with a hook, proof sequence, closing message, narration, timing, and sound cues.
A validated portrait HyperFrames project with captured visuals, captions, snapshots, and a Studio preview.

Using "website-to-video". Turn a documentation site into a 45-second narrated walkthrough.

Expected outcome:

A structured walkthrough that introduces the product, highlights key documentation areas, and closes with a clear next step.

Using "website-to-video". Make a silent square brand reel from a portfolio site.

Expected outcome:

A music-led square composition using portfolio imagery, branded typography, timed transitions, and focused sound effects without narration.

Security Audit

High Risk

v5 • 7/23/2026 Open versioned report

Most static alerts are lexical false positives caused by Markdown links, code formatting, CSS terms, and JavaScript regular expressions. Confirmed concerns include unsafe chat-based credential handling, broad HOME searches, a predictable temporary file, and a remote script without integrity protection. The capture and Gemini workflows also need stronger URL boundaries and confidential-content safeguards.

Files scanned

4,218

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (4)

High

references/step-4-vo.md:63

Environment file access

- **ElevenLabs:** "Add `ELEVENLABS_API_KEY=your-key` to a `.env` file in the project root, or just p

The line offers both a project .env file and chat as credential storage without requiring exclusion from logs or version control.

High

references/step-4-vo.md:64

Environment file access

- **HeyGen:** "Add `HEYGEN_API_KEY=your-key` to a `.env` file, or paste it here."

The line directs handling a reusable HeyGen key through a project file or chat without protective storage requirements.

High

references/step-0-capture.md:13-19

Unrestricted Website Capture Target

The workflow passes a user-supplied URL directly to the capture command without requiring protocol checks or blocking loopback, private, link-local, and metadata addresses.

The documented command accepts an arbitrary URL, and the surrounding capture instructions provide no destination validation or network boundary.

Medium

references/step-0-capture.md:7-11 references/step-6-validate.md:130-144

Incomplete Disclosure for External Image Analysis

Gemini analysis processes captured website images and video snapshots, but the guidance explains quality and cost without warning about confidential content leaving the local environment.

The text states that Gemini describes captured images and snapshot frames. It asks about a key but omits a confidentiality and third-party transfer warning.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/step-4-vo.md:63

Generic API/secret keys

- **ElevenLabs:** "Add `ELEVENLABS_API_KEY=your-key` to a `.env` file in the project root, or just p

The guidance invites users to paste an ElevenLabs API key into chat. Chat history and agent logs are inappropriate credential channels.

High

references/step-4-vo.md:64

Generic API/secret keys

- **HeyGen:** "Add `HEYGEN_API_KEY=your-key` to a `.env` file, or paste it here."

The guidance explicitly invites a HeyGen API key to be pasted into chat. This can expose a reusable account credential.

Medium

references/step-3-storyboard.md:195

Standard device file access

find "$HOME" -path '*/website-to-video/assets/sfx/manifest.json' -maxdepth 10 2>/dev/null | head -1

The command recursively searches the entire HOME tree to locate a manifest. This exceeds the project scope and exposes unrelated directory names.

Medium

references/step-3-storyboard.md:365

Standard device file access

Every text element in this beat must name a specific effect from the catalog. The reference page is

The fallback command recursively searches HOME for another skill reference. A configured skill root would avoid broad filesystem enumeration.

Medium

references/step-4-vo.md:31

Temp directory access

npx hyperframes tts "First sentence. Second sentence." --voice af_nova --output /tmp/test-tts.wav

The command writes to a predictable shared /tmp filename. On multi-user systems, collisions or symlink substitution could overwrite another accessible file.

Medium

references/step-5-build.md:200

Hardcoded URL

Generated projects execute GSAP from a third-party CDN without an integrity hash. CDN compromise or replacement would execute remote code in the preview origin.

Medium

references/step-5-build.md:304

Standard device file access

find "$HOME" -path '*/website-to-video/references/beat-builder-guide.md' -maxdepth 10 2>/dev/null |

The sub-agent instruction searches the complete HOME tree for the guide. It grants broader filesystem visibility than the build requires.

Medium

references/step-6-validate.md:45

Standard device file access

(Locate the repo root from a project subdirectory: `find "$HOME" -path '*/skills/website-to-video/sc

The repository lookup recursively scans HOME. Deterministic installation metadata should provide this path without enumerating unrelated directories.

Risk Factors

📁 Filesystem access (40)

⚡ Contains scripts (6)

references/capabilities.md:478 scripts/w2h-verify.mjs:242 scripts/w2h-verify.mjs:410 scripts/w2h-verify.mjs:510 scripts/w2h-verify.mjs:634 scripts/w2h-verify.mjs:690

🔑 Env variables (12)

references/step-0-capture.md:9 references/step-4-vo.md:63 references/step-4-vo.md:64 references/step-4-vo.md:80 references/step-4-vo.md:84 references/step-4-vo.md:95 references/step-4-vo.md:101 references/step-4-vo.md:106 references/step-6-validate.md:290 references/step-6-validate.md:132 references/step-6-validate.md:133 references/step-6-validate.md:144

⚙️ External commands (50)

🌐 Network access (8)

references/step-3-storyboard.md:70 references/step-4-vo.md:79 references/step-4-vo.md:83 references/step-4-vo.md:100 references/step-4-vo.md:105 references/step-5-build.md:200 references/step-6-validate.md:272 SKILL.md:17

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/heygen-com-website-to-video/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/heygen-com-website-to-video/security.svg)](https://skillstore.io/skills/heygen-com-website-to-video?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/heygen-com-website-to-video?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/heygen-com-website-to-video/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/heygen-com-website-to-video.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

heygen-com. (2026). website-to-video security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/heygen-com-website-to-video/audits/5

BibTeX citation

@techreport{heygen-com-heygen-com-website-to-video-2026,
  author = {heygen-com},
  title = {website-to-video security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/heygen-com-website-to-video/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "website-to-video security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "heygen-com"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/heygen-com-website-to-video/audits/5"
identifiers:
  - type: other
    value: "skillstore:heygen-com-website-to-video:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Publish a Portfolio Reel

Turn a portfolio or agency site into a concise branded reel using its strongest pages, typography, and visual assets.

Create a Documentation Tour

Present a documentation site through a structured walkthrough with readable interface details, narration, and captions.

Produce a Social Showcase

Adapt a homepage or content site into a short portrait, square, or landscape clip for social channels.

Try These Prompts

Create a Basic Site Tour

Create a 30-second landscape tour of [URL]. Use the site's visual identity. Ask me to approve the storyboard before building.

Build a Short Social Clip

Turn [URL] into a 15-second portrait social clip for [audience]. Emphasize [message]. Use captions and local narration.

Develop a Narrated Showcase

Create a 45-second narrated showcase of [URL]. Compare two creative directions, then build the approved direction with captured brand assets.

Direct an Advanced Brand Reel

Produce a 30-second brand reel from [URL] for [audience]. Use [provider] narration, selected WebGL transitions, timed sound design, captions, and full validation.

Best Practices

Confirm the message, audience, duration, format, and narrative arc before writing the storyboard.
Use captured signature visuals in meaningful beats instead of rebuilding the entire brand with generic interface elements.
Review every composition, snapshot, warning, audio cue, and verification result before sharing the final preview.

Avoid

Do not capture private or restricted websites without explicit authorization and a clear data-handling plan.
Do not ask users to paste API keys into chat or place credentials in files that may enter version control.
Do not skip approval and validation gates because the user requested autonomous creative decisions.